One-Shot Verifiable Encryption from Lattices Vadim Lyubashevsky and - PowerPoint PPT Presentation

One-Shot Verifiable Encryption from Lattices Vadim Lyubashevsky and Gregory Neven IBM Research -- Zurich

Zero-Knowledge Proofs

Zero-Knowledge Proofs Relation f(s)=t, and want to prove knowledge of s

Zero-Knowledge Proofs Relation f(s)=t, and want to prove knowledge of s e.g. discrete log: Prove knowledge of s s.t. g s =t

Zero-Knowledge Proofs Relation f(s)=t, and want to prove knowledge of s e.g. discrete log: Prove knowledge of s s.t. g s =t For lattice problems such as SIS and LWE, want to prove knowledge of a short vector s such that f(s)=t

Examples SIS Problem: f A (s) := As mod q 4 11 6 8 10 7 6 14 1 8 = 7 7 1 2 13 0 3 0 0 12 mod 17 2 9 12 5 1 2 5 9 0 14 1 3 14 9 7 1 11 1 1 5 0 1 1 0

Examples LWE Problem: f A (s) := As mod q 4 11 6 8 1 0 0 0 1 12 = 7 7 1 2 0 1 0 0 0 10 mod 17 2 9 12 5 0 0 1 0 0 8 1 3 14 9 0 0 0 1 1 10 0 1 1 0

Polynomial Rings R = Z q [x]/(x d +1) is a polynomial ring with • Addition mod q • Polynomial multiplication mod q and x d +1

Polynomial Rings R = Z q [x]/(x d +1) is a polynomial ring with • Addition mod q • Polynomial multiplication mod q and x d +1 SIS Problem over R: f A (s) := As mod q = a 1 a 2 a 3 a 4 a 5 s 1 y 1 a 6 a 7 a 8 a 9 a 10 s 2 y 2 s 3 s 4 s 5

Constructing Zero-Knowledge Proofs • For discrete log relations – a simple sigma protocol (i.e. Schnorr proof). • Can be made non-interactive via the Fiat-Shamir transformation • For lattice schemes – the main obstacle is that the secret has small length.

“Fiat - Shamir with Aborts” [Lyu ‘09]

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t y  D w=f(y)

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t y  D w=f(y) w

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t y  D w=f(y) w c

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t y  D w=f(y) w c z=sc+y (Rejection z Sample)

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t y  D w=f(y) w c z=sc+y (Rejection z Sample) || z || is small and f(z)=tc+w

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t y  D w=f(y) w c c’ z=sc+y (Rejection z z’ Sample) || z || is small and || z’ || is small and f(z)=tc+w f(z’)=tc’+w

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t y  D w=f(y) w c c’ z=sc+y (Rejection z z’ Sample) || z || is small and || z’ || is small and f(z)=tc+w f(z’)=tc’+w f(z- z’)=t(c - c’)

“Fiat - Shamir with Aborts” [Lyu ‘09] Relation: f(s)=t In a non-interactive y  D protocols, replaced with w=f(y) c=H(w,t) w c c’ z=sc+y (Rejection z z’ Sample) || z || is small and || z’ || is small and f(z)=tc+w f(z’)=tc’+w f(z- z’)=t(c - c’)

Implications of the Extraction

Implications of the Extraction f(z- z’)=t(c - c’) if (c- c’) -1 exists f((z- z’)/(c - c’))=t

Implications of the Extraction f(z- z’)=t(c - c’) if (c- c’) -1 exists f((z- z’)/(c - c’))=t But (z- z’)/(c - c’) does not necessarily have small coefficients! Unless … c,c’ in {0,1} … But then soundness is only 1/2.

Practical (< 20KB per proof) Applications

Practical (< 20KB per proof) Applications f(ŝ) = tĉ

Practical (< 20KB per proof) Applications Digital signatures [Lyu ‘09,…] , ZK proofs of commitments [BKLP ‘16] , (maybe others) f(ŝ) = tĉ

Practical (< 20KB per proof) Applications Digital signatures [Lyu ‘09,…] , ZK proofs of commitments [BKLP ‘16] , (maybe others) f(ŝ) = tĉ f(ŝ)=t when simultaneously proving many (>> 10,000) relations [Lyu ’ 09] + [BDLN ’16] + [CDXY ’17]

(Stern-type Lattice ZK Proofs) • Combinatorial based on the code-based Stern identification scheme with 0/1 secrets [Ste ‘93] • Can be adapted to larger secrets at a significant efficiency loss [LNSW ‘13]

(Stern-type Lattice ZK Proofs) • Combinatorial based on the code-based Stern identification scheme with 0/1 secrets [Ste ‘93] • Can be adapted to larger secrets at a significant efficiency loss [LNSW ‘13] • Proofs are almost always >> 1 MB (depending on how big the coefficients of s are) • Not considered relevant for practical applications

Main Open Problems Digital signatures [Lyu ‘09,…] , ZK proofs of commitments [BKLP ‘16] , (maybe others) f(ŝ) = tĉ f(ŝ)=t when simultaneously proving many (>> 10,000) relations [Lyu ’ 09] + [BDLN ’16] + [CDXY ’17]

Main Open Problems Digital signatures [Lyu ‘09,…] , ZK proofs of commitments [BKLP ‘16] , (maybe others) More applications f(ŝ) = tĉ f(ŝ)=t when simultaneously proving many (>> 10,000) relations [Lyu ’ 09] + [BDLN ’16] + [CDXY ’17]

Main Open Problems Digital signatures [Lyu ‘09,…] , ZK proofs of commitments [BKLP ‘16] , (maybe others) More applications f(ŝ) = tĉ f(ŝ)=t when simultaneously proving many (>> 10,000) relations [Lyu ’ 09] + [BDLN ’16] + [CDXY ’17] Decrease the number of required samples

ZK Proof of Plaintext Knowledge and Verifiable Encryption

ZK Proof of Plaintext Knowledge and Verifiable Encryption Mediating Authority Sender Receiver

ZK Proof of Plaintext Knowledge and Verifiable Encryption Mediating Authority Publishes pk to some encryption scheme Have some secret witness w that x is in language L Sender Receiver

ZK Proof of Plaintext Knowledge and Verifiable Encryption Mediating Authority Publishes pk to some encryption scheme Have some secret witness w that x is in language L c:=Enc pk (w) π :=ZKPoK(w is a witness and c encrypts w) Sender Receiver

ZK Proof of Plaintext Knowledge and Verifiable Encryption Mediating Authority Publishes pk to some encryption scheme If the Sender Have some secret misbehaves, the witness w that x is Authority will in language L reveal w c:=Enc pk (w) π :=ZKPoK(w is a witness and c encrypts w) Sender Receiver

ZK Proof of Plaintext Knowledge Mediating Authority Publishes pk to some encryption scheme If the Sender misbehaves, the Have some secret w Authority will reveal w c:=Enc pk (w) π :=ZKPoK(c encrypts w) Sender Receiver

Ring-LWE Encryption Scheme Public Key: a, as+e=t Encryption(m): u=p(ar+e 1 ) , v=p(tr+e 2 )+m = pa p 0 0 r u pt 0 p 1 e 1 v e 2 w Decryption: v-us mod q mod p

Approximate Proofs and Proofs of Plaintext Knowledge = pa p 0 0 r u pt 0 p 1 e 1 v e 2 w

Approximate Proofs and Proofs of Plaintext Knowledge = pa p 0 0 r u pt 0 p 1 e 1 v e 2 w = pa p 0 0 ȓ uĉ pt 0 p 1 ê 1 vĉ ê 2 ŵ

Problem with Approximate Proofs = pa p 0 0 ȓ uĉ pt 0 p 1 ê 1 vĉ ê 2 ŵ Implication: (v - us) ĉ mod q mod p = ŵ

Problem with Approximate Proofs = pa p 0 0 ȓ uĉ pt 0 p 1 ê 1 vĉ ê 2 ŵ Implication: (v - us) ĉ mod q mod p = ŵ But decryptor does not know ĉ

Problem with Approximate Proofs = pa p 0 0 ȓ uĉ pt 0 p 1 ê 1 vĉ ê 2 ŵ Implication: (v - us) ĉ mod q mod p = ŵ But decryptor does not know ĉ If he decrypts (u,v), he may get garbage because (u,v) is not a valid ciphertext

Our Solution Outline 1. Guess ĉ uĉ 2. ŵ:=Decrypt vĉ 3. Output ŵ/ĉ mod p

Our Solution Outline There could be 1. Guess ĉ |challenge space| 2 possibilities uĉ 2. ŵ:=Decrypt vĉ 3. Output ŵ/ĉ mod p

Our Solution Outline There could be 1. Guess ĉ |challenge space| 2 possibilities uĉ How can we be sure we 2. ŵ:=Decrypt vĉ guessed the right ĉ? 3. Output ŵ/ĉ mod p

Our Solution Outline There could be 1. Guess ĉ |challenge space| 2 possibilities uĉ How can we be sure we 2. ŵ:=Decrypt vĉ guessed the right ĉ? Is this unique? 3. Output ŵ/ĉ mod p (Decryption should be unique)

There could be 1. Guess ĉ |challenge space| 2 possibilities uĉ How can we be sure we 2. ŵ:=Decrypt vĉ guessed the right ĉ? Is this unique? 3. Output ŵ/ĉ mod p (Decryption should be unique)

There could be 1. Guess ĉ |challenge space| 2 possibilities uĉ How can we be sure we 2. ŵ:=Decrypt vĉ guessed the right ĉ? Is this unique? 3. Output ŵ/ĉ mod p (Decryption should be unique) We modify the parameters and the decryption algorithm of the Ring-LWE scheme

There could be 1. Guess ĉ |challenge space| 2 possibilities uĉ How can we be sure we 2. ŵ:=Decrypt vĉ guessed the right ĉ? Is this unique? 3. Output ŵ/ĉ mod p (Decryption should be unique) We modify the parameters and the decryption algorithm of the Ring-LWE scheme In the decryption algorithm, check that || (v - us) ĉ mod q || ∞ < q/2C where C=max || ĉ || 1